This vulnerability allows an attacker to set the Avro schema URL in a table definition, causing Impala to issue an HTTP GET request to any supplied host. The response can surface in parsing error messages, potentially leaking internal endpoint information. The weakness is a classic SSRF, identified as CWE‑918, which can enable attackers to probe or access services that Impala itself can reach, thereby compromising confidentiality and possibly enabling further exploitation.

Apache Impala versions 2.0.0 through 4.5.1 on all platforms are affected when a table is created or altered to include tblproperties('avro.schema.url'='http://…') or a file:/// URI. Systems running these Impala versions and hosting such tables are vulnerable.

The CVSS score is not provided, and the EPSS score is unavailable, but the vulnerability is listed as not in the CISA KEV catalog. Exploitation requires the ability to create or modify a table to inject the schema URL, which is typically available to users with write access to the database. Once the property is set, Impala will automatically send the GET request, and error responses could reveal sensitive data, indicating a high potential impact if exploited. The lack of EPSS data means the likelihood cannot be precisely quantified, but SSRF flaws are generally considered high risk if exposed.